ci: add iOS release artifact upload

[pwltr]

Summary

Adds the Phase 2 release artifact workflow for iOS and updates the Android publish workflow dependencies needed by the native build.

Changes

• Add an iOS release workflow that builds VssRustClientFfi.xcframework.zip
• Upload the iOS XCFramework zip as a GitHub Actions artifact
• Upload the iOS XCFramework zip to the GitHub release
• Compute and print the SwiftPM checksum in the workflow summary
• Add missing native build/package dependencies to the Android publish workflow

Why

Phase 1 added read-only validation workflows to prove that generated mobile artifacts can be built in CI. This PR adds the trusted release-side iOS artifact workflow so release assets can be produced and attached from CI instead of relying on locally generated files.

Android publishing already existed, so this only adjusts its dependency setup.

Testing

• bash -n build_ios.sh build_android.sh build.sh build_python.sh

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ccffa2c607

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[pwltr]

After testing this flow, I think we should keep iOS release upload manual for now.

Reason: SwiftPM validates binary targets against the checksum committed in Package.swift, and that checksum must match the exact VssRustClientFfi.xcframework.zip uploaded to the GitHub release. We confirmed that rebuilding the XCFramework zip in a separate environment can produce a different checksum, even from the same source revision. That makes a simple “release published -> CI rebuilds zip -> uploads asset” workflow unsafe.

The safer release model for iOS is:

1. Maintainer runs ./build_ios.sh locally for the release.
2. That build produces bindings/ios/VssRustClientFfi.xcframework.zip and updates Package.swift with the matching checksum.
3. Maintainer commits the generated release metadata/bindings.
4. Maintainer tags that exact commit.
5. Maintainer uploads the exact locally built zip to the GitHub release.

This keeps the Package.swift checksum and release asset tied to the same build output. CI should still validate that iOS artifacts can be generated, but it should not upload a rebuilt zip to a release unless CI owns the full release transaction: build artifact, update Package.swift, commit, tag, create release, and upload the same zip.